@civitai/blocks-react 0.74.1 → 0.76.0

package/dist/internal/mockWorkflowGraph.js

@@ -10,6 +10,7 @@
  * whether its `path` exists, and it prices nothing. A body this accepts can
  * still be refused by the real host or by the orchestrator.
  */
+import { PASS_THROUGH_INPUT_BYTES_MAX } from './stepInputLimits.js';
 /**
  * The bounds the mock enforces. `maxSteps` is a COPY of
  * `@civitai/app-sdk/blocks`'s `BLOCK_WORKFLOW_MAX_STEPS`, deliberately not
@@ -27,8 +28,11 @@ export const MOCK_WORKFLOW_BOUNDS = {
     maxInputDepth: 32,
     /** How deep a `repeat` template may nest another `repeat`. */
     maxRepeatNesting: 4,
-    /** Serialized bytes of every step `input` plus `arguments`, summed. */
-    maxInputBytes: 262_144,
+    /**
+     * Serialized bytes of every step `input` plus `arguments`, summed. The host's
+     * `WORKFLOW_INPUT_BYTES_MAX`, which is its pass-through cap by definition.
+     */
+    maxInputBytes: PASS_THROUGH_INPUT_BYTES_MAX,
     /** Characters of a step `$type`, and of a step `name` on the wire. */
     maxTypeChars: 64,
     /**
@@ -335,15 +339,19 @@ export function mockUnquotedWorkflowEstimateRefusal(failure) {
         errorCode: `workflow_quote_${failure}`,
     };
 }
-/** The host's wire schema, mirrored: exact keys, types and sizes. No `errorCode`. */
-function isWellFormedBody(body) {
+/**
+ * The host's wire schema, mirrored: exact keys, types and sizes — everything
+ * but the summed byte cap. Exported so the step-input gate
+ * (`mockHostStepInput.ts`) runs its rules only on a body the schema's shape
+ * accepts, as zod runs a refinement only after the shape parses.
+ */
+export function isWellFormedWorkflowShape(body) {
     if (!isPlainObject(body) || !Object.keys(body).every((key) => BODY_KEYS.has(key)))
         return false;
     if (!Array.isArray(body.steps) || body.steps.length === 0)
         return false;
     if (body.arguments !== undefined && !isPlainObject(body.arguments))
         return false;
-    let bytes = body.arguments ? JSON.stringify(body.arguments).length : 0;
     for (const step of body.steps) {
         if (!isPlainObject(step) || !Object.keys(step).every((key) => STEP_KEYS.has(key)))
             return false;
@@ -359,8 +367,16 @@ function isWellFormedBody(body) {
             return false;
         if (suppressOutput !== undefined && typeof suppressOutput !== 'boolean')
             return false;
-        bytes += JSON.stringify(input).length;
     }
+    return true;
+}
+/** The host's wire schema, mirrored in full: the shape, then the summed byte cap. No `errorCode`. */
+function isWellFormedBody(body) {
+    if (!isWellFormedWorkflowShape(body))
+        return false;
+    let bytes = body.arguments ? JSON.stringify(body.arguments).length : 0;
+    for (const step of body.steps)
+        bytes += JSON.stringify(step.input).length;
     return bytes <= MOCK_WORKFLOW_BOUNDS.maxInputBytes;
 }
 /**

package/dist/internal/stepInputLimits.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The host's limits on a PASS-THROUGH step `input`: a `kind: 'step'` body with
+ * no `step` id, and every step `input` plus `arguments` of a `kind: 'workflow'`
+ * body.
+ *
+ * 🔴 A VERBATIM PORT. The inline-media half is civitai/civitai
+ * `src/server/schema/blocks/inline-media.ts` (constants, regexes, the walk, the
+ * path format and the message), and the byte cap is `PASS_THROUGH_INPUT_BYTES_MAX`
+ * in `src/server/schema/blocks/workflow.schema.ts`. `test/stepInputLimits.test.ts`
+ * pins the values and the message template to the server's literals. Change
+ * this file only to follow the server, never to improve on it.
+ *
+ * Dependency-free on purpose: the mock host uses it, and nothing here may raise
+ * this package's `@civitai/app-sdk` peer floor
+ * (`tests/guards/blocks-react-peer-floor.test.mjs`).
+ */
+/**
+ * Max serialized size of one pass-through step `input`, and the host's summed
+ * `WORKFLOW_INPUT_BYTES_MAX` for a `kind: 'workflow'` body (defined equal).
+ *
+ * 🔴 MEASURED AS THE SERVER MEASURES IT: `JSON.stringify(input).length`, the
+ * UTF-16 length of the serialization, NOT its UTF-8 byte count. The server's
+ * error says "byte", but a non-ASCII input is counted in code units, so do not
+ * "fix" this to `TextEncoder` — that would refuse bodies the host accepts.
+ */
+export declare const PASS_THROUGH_INPUT_BYTES_MAX = 262144;
+export declare const INLINE_MEDIA_DATA_URI_REGEX: RegExp;
+/** Base64 alphabet with optional `=` padding. Line-wrapped (MIME) base64 does not match. */
+export declare const INLINE_MEDIA_RAW_BASE64_REGEX: RegExp;
+/**
+ * Above any id, hash or token a step input carries. Raw base64 shorter than this
+ * is not refused; only the data-URI clause catches a tiny image.
+ */
+export declare const INLINE_MEDIA_RAW_BASE64_MIN_CHARS = 4096;
+/**
+ * Values one body may hold before it is refused outright. A body past it is
+ * padding — often properties holding `undefined`, which the byte cap counts as
+ * zero bytes — so the search fails CLOSED rather than giving up and accepting.
+ */
+export declare const INLINE_MEDIA_MAX_VISITS = 262144;
+export type InlineMediaPath = (string | number)[];
+/**
+ * Shared by every field of one body, so many fields cannot each spend a full
+ * budget. `stringChars` is a lower bound on the body's JSON length, counted from
+ * the strings the search has passed; `inspected` counts the characters handed to
+ * the patterns. `maxVisits` replaces {@link INLINE_MEDIA_MAX_VISITS} as the value
+ * budget, for a caller whose own cap needs a smaller or larger one (the step and
+ * workflow arms never set it).
+ */
+export type InlineMediaBudget = {
+    visits: number;
+    stringChars?: number;
+    inspected?: number;
+    maxVisits?: number;
+};
+/** Returned when the body holds more values than the budget allows ({@link INLINE_MEDIA_MAX_VISITS}). */
+export declare const INLINE_MEDIA_TOO_MANY_VALUES = "too-many-values";
+/**
+ * Returned once the strings already passed make the body's JSON longer than the
+ * byte limit the caller named. From there no further string is read (the walk
+ * still finishes, for the value budget); the caller's byte cap refuses the body.
+ * So a photo AFTER a string that already crossed the cap gets the byte-cap
+ * message, not the inline-media one.
+ */
+export declare const INLINE_MEDIA_OVER_BYTE_LIMIT = "over-byte-limit";
+export declare function isInlineMediaString(value: string): boolean;
+/** One value in a walk: where it sits (`key` in `parent`, `null` at the root) and what it is. */
+export type JsonWalkFrame = {
+    value: unknown;
+    key: string | number | null;
+    parent: JsonWalkFrame | null;
+};
+/** `'stop'` ends the walk at this value; `'skip'` leaves its children unvisited. */
+export type JsonWalkVisitor = (frame: JsonWalkFrame) => 'stop' | 'skip' | void;
+/**
+ * Visits every value in `value` in document order: array items by index, then
+ * own enumerable keys in `for…in` order. Each value costs one visit from
+ * `budget`, charged when its container is opened, so a container with too many
+ * children ends the walk before any of them is visited.
+ *
+ * Returns the frame `visit` stopped at, `null` once every value is visited, or
+ * {@link INLINE_MEDIA_TOO_MANY_VALUES} once `budget` is spent. Iterative, so
+ * nesting depth cannot overflow the stack.
+ */
+export declare function walkJsonValues(value: unknown, budget: InlineMediaBudget, visit: JsonWalkVisitor): JsonWalkFrame | null | typeof INLINE_MEDIA_TOO_MANY_VALUES;
+/**
+ * The JSON path of the first string in `value`, in document order, that carries
+ * inline media; `null` if none; {@link INLINE_MEDIA_TOO_MANY_VALUES} once
+ * `budget` is spent.
+ *
+ * With a `byteLimit`, each string is checked BEFORE its length is counted, so
+ * the string that crosses the limit is still searched: an over-limit photo gets
+ * this message, not the byte cap's. Once the counted strings pass the limit, no
+ * later string is read; the walk still finishes, so a body past the value budget
+ * is reported as before, and otherwise the search returns
+ * {@link INLINE_MEDIA_OVER_BYTE_LIMIT}. The count is a lower bound on the JSON
+ * length (each string's characters and quotes, only where `JSON.stringify`
+ * writes it), so it never passes the limit for a body that fits.
+ */
+export declare function findInlineMediaPath(value: unknown, budget?: InlineMediaBudget, byteLimit?: number): InlineMediaPath | null | typeof INLINE_MEDIA_TOO_MANY_VALUES | typeof INLINE_MEDIA_OVER_BYTE_LIMIT;
+/** `['input', 'images', 0]` → `input.images[0]`. */
+export declare function formatInlineMediaPath(path: InlineMediaPath): string;
+export declare function inlineMediaMessage(path: InlineMediaPath): string;
+//# sourceMappingURL=stepInputLimits.d.ts.map

package/dist/internal/stepInputLimits.js

@@ -0,0 +1,179 @@
+/**
+ * The host's limits on a PASS-THROUGH step `input`: a `kind: 'step'` body with
+ * no `step` id, and every step `input` plus `arguments` of a `kind: 'workflow'`
+ * body.
+ *
+ * 🔴 A VERBATIM PORT. The inline-media half is civitai/civitai
+ * `src/server/schema/blocks/inline-media.ts` (constants, regexes, the walk, the
+ * path format and the message), and the byte cap is `PASS_THROUGH_INPUT_BYTES_MAX`
+ * in `src/server/schema/blocks/workflow.schema.ts`. `test/stepInputLimits.test.ts`
+ * pins the values and the message template to the server's literals. Change
+ * this file only to follow the server, never to improve on it.
+ *
+ * Dependency-free on purpose: the mock host uses it, and nothing here may raise
+ * this package's `@civitai/app-sdk` peer floor
+ * (`tests/guards/blocks-react-peer-floor.test.mjs`).
+ */
+/**
+ * Max serialized size of one pass-through step `input`, and the host's summed
+ * `WORKFLOW_INPUT_BYTES_MAX` for a `kind: 'workflow'` body (defined equal).
+ *
+ * 🔴 MEASURED AS THE SERVER MEASURES IT: `JSON.stringify(input).length`, the
+ * UTF-16 length of the serialization, NOT its UTF-8 byte count. The server's
+ * error says "byte", but a non-ASCII input is counted in code units, so do not
+ * "fix" this to `TextEncoder` — that would refuse bodies the host accepts.
+ */
+export const PASS_THROUGH_INPUT_BYTES_MAX = 262_144;
+export const INLINE_MEDIA_DATA_URI_REGEX = /^\s*data:(image|video|audio)\//i;
+/** Base64 alphabet with optional `=` padding. Line-wrapped (MIME) base64 does not match. */
+export const INLINE_MEDIA_RAW_BASE64_REGEX = /^[A-Za-z0-9+/]+={0,2}$/;
+/**
+ * Above any id, hash or token a step input carries. Raw base64 shorter than this
+ * is not refused; only the data-URI clause catches a tiny image.
+ */
+export const INLINE_MEDIA_RAW_BASE64_MIN_CHARS = 4096;
+/**
+ * Values one body may hold before it is refused outright. A body past it is
+ * padding — often properties holding `undefined`, which the byte cap counts as
+ * zero bytes — so the search fails CLOSED rather than giving up and accepting.
+ */
+export const INLINE_MEDIA_MAX_VISITS = 262_144;
+/** Returned when the body holds more values than the budget allows ({@link INLINE_MEDIA_MAX_VISITS}). */
+export const INLINE_MEDIA_TOO_MANY_VALUES = 'too-many-values';
+/**
+ * Returned once the strings already passed make the body's JSON longer than the
+ * byte limit the caller named. From there no further string is read (the walk
+ * still finishes, for the value budget); the caller's byte cap refuses the body.
+ * So a photo AFTER a string that already crossed the cap gets the byte-cap
+ * message, not the inline-media one.
+ */
+export const INLINE_MEDIA_OVER_BYTE_LIMIT = 'over-byte-limit';
+export function isInlineMediaString(value) {
+    if (INLINE_MEDIA_DATA_URI_REGEX.test(value))
+        return true;
+    return value.length >= INLINE_MEDIA_RAW_BASE64_MIN_CHARS && INLINE_MEDIA_RAW_BASE64_REGEX.test(value);
+}
+function pathOf(frame) {
+    const path = [];
+    for (let f = frame; f && f.key !== null; f = f.parent)
+        path.push(f.key);
+    return path.reverse();
+}
+/**
+ * Visits every value in `value` in document order: array items by index, then
+ * own enumerable keys in `for…in` order. Each value costs one visit from
+ * `budget`, charged when its container is opened, so a container with too many
+ * children ends the walk before any of them is visited.
+ *
+ * Returns the frame `visit` stopped at, `null` once every value is visited, or
+ * {@link INLINE_MEDIA_TOO_MANY_VALUES} once `budget` is spent. Iterative, so
+ * nesting depth cannot overflow the stack.
+ */
+export function walkJsonValues(value, budget, visit) {
+    const maxVisits = budget.maxVisits ?? INLINE_MEDIA_MAX_VISITS;
+    const stack = [{ value, key: null, parent: null }];
+    if (++budget.visits > maxVisits)
+        return INLINE_MEDIA_TOO_MANY_VALUES;
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        const verdict = visit(frame);
+        if (verdict === 'stop')
+            return frame;
+        const node = frame.value;
+        if (verdict === 'skip' || node === null || typeof node !== 'object')
+            continue;
+        const children = [];
+        if (Array.isArray(node)) {
+            for (let i = 0; i < node.length; i++) {
+                if (++budget.visits > maxVisits)
+                    return INLINE_MEDIA_TOO_MANY_VALUES;
+                children.push({ value: node[i], key: i, parent: frame });
+            }
+        }
+        else {
+            for (const key in node) {
+                if (!Object.prototype.hasOwnProperty.call(node, key))
+                    continue;
+                if (++budget.visits > maxVisits)
+                    return INLINE_MEDIA_TOO_MANY_VALUES;
+                children.push({ value: node[key], key, parent: frame });
+            }
+        }
+        for (let i = children.length - 1; i >= 0; i--)
+            stack.push(children[i]);
+    }
+    return null;
+}
+/**
+ * A container whose own entries `JSON.stringify` writes as they are: an array or
+ * a plain object, without `toJSON` (own or inherited) and not a boxed value.
+ */
+function writesOwnEntries(value) {
+    if (typeof value.toJSON === 'function')
+        return false;
+    if (value instanceof String || value instanceof Number || value instanceof Boolean)
+        return false;
+    return true;
+}
+/**
+ * The JSON path of the first string in `value`, in document order, that carries
+ * inline media; `null` if none; {@link INLINE_MEDIA_TOO_MANY_VALUES} once
+ * `budget` is spent.
+ *
+ * With a `byteLimit`, each string is checked BEFORE its length is counted, so
+ * the string that crosses the limit is still searched: an over-limit photo gets
+ * this message, not the byte cap's. Once the counted strings pass the limit, no
+ * later string is read; the walk still finishes, so a body past the value budget
+ * is reported as before, and otherwise the search returns
+ * {@link INLINE_MEDIA_OVER_BYTE_LIMIT}. The count is a lower bound on the JSON
+ * length (each string's characters and quotes, only where `JSON.stringify`
+ * writes it), so it never passes the limit for a body that fits.
+ */
+export function findInlineMediaPath(value, budget = { visits: 0 }, byteLimit = Infinity) {
+    // Containers whose entries `JSON.stringify` does not write as they are (a
+    // boxed value, an object with `toJSON`), and everything under them: their
+    // strings are not counted.
+    const unwritten = new Set();
+    let overLimit = false;
+    const hit = walkJsonValues(value, budget, (frame) => {
+        const node = frame.value;
+        const counted = !(frame.parent && unwritten.has(frame.parent));
+        if (node !== null && typeof node === 'object') {
+            if (!counted || !writesOwnEntries(node))
+                unwritten.add(frame);
+            return undefined;
+        }
+        if (typeof node !== 'string')
+            return undefined;
+        if ((budget.stringChars ?? 0) > byteLimit) {
+            overLimit = true;
+            return undefined;
+        }
+        budget.inspected = (budget.inspected ?? 0) + node.length;
+        if (isInlineMediaString(node))
+            return 'stop';
+        if (counted)
+            budget.stringChars = (budget.stringChars ?? 0) + node.length + 2;
+        return undefined;
+    });
+    if (hit === INLINE_MEDIA_TOO_MANY_VALUES)
+        return hit;
+    if (overLimit)
+        return INLINE_MEDIA_OVER_BYTE_LIMIT;
+    return hit ? pathOf(hit) : null;
+}
+/** `['input', 'images', 0]` → `input.images[0]`. */
+export function formatInlineMediaPath(path) {
+    return path.reduce((out, seg) => {
+        if (typeof seg === 'number')
+            return `${out}[${seg}]`;
+        return out ? `${out}.${seg}` : seg;
+    }, '');
+}
+export function inlineMediaMessage(path) {
+    return (`${formatInlineMediaPath(path)} carries inline media (data URI/base64); ` +
+        `pass a hosted url instead — upload the image, video or audio with useMediaUpload ` +
+        `(an image also works with useImageUpload({ purpose: 'generationSource' }) or ` +
+        `useImagePicker) and pass the returned url`);
+}
+//# sourceMappingURL=stepInputLimits.js.map

package/dist/testing.d.ts

@@ -22,6 +22,8 @@ import { type MockHostOptions } from './internal/mockHost.js';
 export { __resetTransport as resetTransport };
 export { installPopoverShim, type PopoverShimHandle, type PopoverShimOptions, } from './internal/popoverShim.js';
 export { createMockHost, readMockHostUrlOptions, type MockHost, type MockHostOptions, type MockHostFailMode, type MockHostScenarioPatch, type MockGenerationScenario, type MockBuzzScenario, type MockBuzzBalance, type MockBuzzHandle, type MockStorageScenario, type MockSharedScenario, type MockSharedSeed, type MockCannedImageScan, type MockWorkflowStepInfo, type MockWorkflowQuoteFailure, type CostSpec, type ImageSpec, type CannedPick, } from './internal/mockHost.js';
+export { type MockMediaUploads } from './internal/mediaUploadBytes.js';
+export { type MockReactionSeed } from './internal/mockHostReactions.js';
 export { fakeResourceSource, type FakeResourceCanned, type FakeResourceSource, } from './internal/fakeResourceSource.js';
 /**
  * Props for the dev {@link Harness}.

package/dist/transport/requestTimeouts.js

@@ -70,6 +70,7 @@ const REQUEST_TIMEOUT_CLASS = {
     OPEN_CHECKPOINT_PICKER: 'human', //      viewer browses + picks
     OPEN_IMAGE_PICKER: 'human', //           viewer browses their images + picks
     OPEN_IMAGE_UPLOAD: 'human', //           viewer chooses a file
+    OPEN_MEDIA_UPLOAD: 'human', //           viewer picks a file, or a 64 MB upload + host retries
     OPEN_RESOURCE_PICKER: 'human', //        viewer browses + picks
     PUBLISH_GENERATION_OUTPUTS: 'human', //  viewer answers a consent confirm (#4158)
     // 🔴 `'human'` for the SAME reason as PUBLISH_GENERATION_OUTPUTS, and the
@@ -159,6 +160,12 @@ const REQUEST_TIMEOUT_CLASS = {
     // whether a human is involved. Not reclassified here.
     SAVE_IMAGE: 'protocol',
     SET_USER_CHECKPOINT: 'protocol',
+    // App reactions. `'protocol'`, NOT `'human'`, and that is a decision rather
+    // than an omission: unlike SET_COLLECTION_FOLLOW there is no host confirm to
+    // wait on. The consent is the `social:react:self` grant, made beforehand; a
+    // host without it refuses `needs-consent` at once.
+    SET_ENTITY_REACTION: 'protocol',
+    GET_ENTITY_REACTIONS: 'protocol',
     SHARED_APPEND: 'protocol',
     SHARED_GET: 'protocol',
     SHARED_GET_COUNT: 'protocol',

package/dist/transport/validate.d.ts

@@ -395,6 +395,30 @@ export declare function isValidImagesResult(p: unknown): boolean;
  * reach a consumer keying UI state by id.
  */
 export declare function isValidCollectionFollowResult(p: unknown): boolean;
+/**
+ * Reply to a block-initiated `SET_ENTITY_REACTION`. A well-formed reply carries
+ * EITHER a `result` OR an `error`; one with neither is malformed and dropped.
+ *
+ * `error` is SHAPE-CHECKED ONLY, although the host's set is closed
+ * (`ENTITY_REACTION_ERROR_CODES`): a code a newer host adds must still reach
+ * the block as a rejection. A membership check would drop it, and a dropped
+ * reply on a request-style message does not reject, it waits out the timeout.
+ * `useReactions` turns an unknown string into a `ReactionError` with no `code`.
+ *
+ * `result` is checked as far as a consumer reads it: `entityId` a positive
+ * integer (state is keyed by it), `reaction` a non-empty string, `reacted` and
+ * `changed` booleans, plus the state fields.
+ */
+export declare function isValidEntityReactionResult(p: unknown): boolean;
+/**
+ * Reply to a block-initiated `GET_ENTITY_REACTIONS`. Same one-of and shape-only
+ * `error` contract as {@link isValidEntityReactionResult}.
+ *
+ * `result.byId` must be an object whose every key is a positive-integer id
+ * spelled as a string and whose every value is a valid state;
+ * `result.unavailable` an array of positive-integer ids.
+ */
+export declare function isValidEntityReactionsResult(p: unknown): boolean;
 /**
  * Reply to a block-initiated `CREATE_POST_FROM_APP`. A well-formed reply carries
  * EITHER a `result` (`{ postId: positive int, url: non-empty string, imageIds:
@@ -581,6 +605,17 @@ export declare function isValidResourcePickerResult(p: unknown): boolean;
  * out its whole human-interaction timeout on a refusal the host already sent.
  */
 export declare function isValidImagePickerResult(p: unknown): boolean;
+/**
+ * Reply to `OPEN_MEDIA_UPLOAD`: `{ requestId, selected }`, `{ requestId, error }`
+ * or a bare `{ requestId }` (dismissed / declined).
+ *
+ * `error` must be a string when present, and a reply carrying one is accepted
+ * without looking further: `useMediaUpload` throws on a PRESENT `error` before
+ * it reads `selected`. 🔴 Accepting it is load-bearing: dropping
+ * `{ requestId, error }` would leave the hook waiting out its whole
+ * human-interaction timeout on a refusal the host already sent.
+ */
+export declare function isValidMediaUploadResult(p: unknown): boolean;
 /**
  * Reply to `SET_USER_CHECKPOINT`. `ok` is required on the success path; the
  * hook throws on `!ok || error !== undefined` — presence, not truthiness, so an

package/dist/transport/validate.js

@@ -1368,6 +1368,121 @@ export function isValidCollectionFollowResult(p) {
         return false;
     return true;
 }
+/** A positive integer id: what a reaction reply keys UI state by. */
+function isPositiveIntId(v) {
+    return typeof v === 'number' && Number.isInteger(v) && v > 0;
+}
+/**
+ * One image's reaction state inside an `ENTITY_REACTION(S)_RESULT`: `counts` an
+ * object of finite numbers, `viewerReactions` an array of strings,
+ * `statsUnknown` a boolean.
+ *
+ * 🔴 The reaction NAMES are not membership-checked, in `counts` or in
+ * `viewerReactions`. The site stores five reactions and may add a sixth; a
+ * reply naming one this SDK does not know is still a true statement about the
+ * viewer, and dropping it would hang the request to its timeout instead.
+ */
+function isValidEntityReactionState(v) {
+    if (!isObject(v))
+        return false;
+    if (!isObject(v.counts))
+        return false;
+    for (const n of Object.values(v.counts)) {
+        if (!isFiniteNumber(n))
+            return false;
+    }
+    if (!Array.isArray(v.viewerReactions))
+        return false;
+    for (const r of v.viewerReactions) {
+        if (typeof r !== 'string')
+            return false;
+    }
+    if (typeof v.statsUnknown !== 'boolean')
+        return false;
+    return true;
+}
+/**
+ * Reply to a block-initiated `SET_ENTITY_REACTION`. A well-formed reply carries
+ * EITHER a `result` OR an `error`; one with neither is malformed and dropped.
+ *
+ * `error` is SHAPE-CHECKED ONLY, although the host's set is closed
+ * (`ENTITY_REACTION_ERROR_CODES`): a code a newer host adds must still reach
+ * the block as a rejection. A membership check would drop it, and a dropped
+ * reply on a request-style message does not reject, it waits out the timeout.
+ * `useReactions` turns an unknown string into a `ReactionError` with no `code`.
+ *
+ * `result` is checked as far as a consumer reads it: `entityId` a positive
+ * integer (state is keyed by it), `reaction` a non-empty string, `reacted` and
+ * `changed` booleans, plus the state fields.
+ */
+export function isValidEntityReactionResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.result !== undefined) {
+        const r = p.result;
+        if (!isObject(r))
+            return false;
+        if (!isNonEmptyString(r.entityType))
+            return false;
+        if (!isPositiveIntId(r.entityId))
+            return false;
+        if (!isNonEmptyString(r.reaction))
+            return false;
+        if (typeof r.reacted !== 'boolean')
+            return false;
+        if (typeof r.changed !== 'boolean')
+            return false;
+        if (!isValidEntityReactionState(r))
+            return false;
+    }
+    if (p.result === undefined && p.error === undefined)
+        return false;
+    return true;
+}
+/**
+ * Reply to a block-initiated `GET_ENTITY_REACTIONS`. Same one-of and shape-only
+ * `error` contract as {@link isValidEntityReactionResult}.
+ *
+ * `result.byId` must be an object whose every key is a positive-integer id
+ * spelled as a string and whose every value is a valid state;
+ * `result.unavailable` an array of positive-integer ids.
+ */
+export function isValidEntityReactionsResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.result !== undefined) {
+        const r = p.result;
+        if (!isObject(r))
+            return false;
+        if (!isNonEmptyString(r.entityType))
+            return false;
+        if (!isObject(r.byId))
+            return false;
+        for (const [key, state] of Object.entries(r.byId)) {
+            if (!/^[1-9][0-9]*$/.test(key))
+                return false;
+            if (!isValidEntityReactionState(state))
+                return false;
+        }
+        if (!Array.isArray(r.unavailable))
+            return false;
+        for (const id of r.unavailable) {
+            if (!isPositiveIntId(id))
+                return false;
+        }
+    }
+    if (p.result === undefined && p.error === undefined)
+        return false;
+    return true;
+}
 /**
  * Reply to a block-initiated `CREATE_POST_FROM_APP`. A well-formed reply carries
  * EITHER a `result` (`{ postId: positive int, url: non-empty string, imageIds:
@@ -2041,6 +2156,60 @@ export function isValidImagePickerResult(p) {
     }
     return true;
 }
+const MEDIA_UPLOAD_KINDS = new Set(['image', 'video', 'audio']);
+const isPositiveInteger = (v) => typeof v === 'number' && Number.isInteger(v) && v > 0;
+/**
+ * One `BlockMediaUploadInfo`: a non-empty `url`, a known `kind`, a string
+ * `mimeType`, a whole `sizeBytes` ≥ 0, and dimensions by kind. `width` and
+ * `height` are positive whole numbers when present, REQUIRED for `image` and
+ * `video` (the host always measures them) and ABSENT for `audio`. `durationMs`
+ * is a finite number ≥ 0 when present.
+ */
+function isValidMediaUploadInfo(s) {
+    if (!isObject(s))
+        return false;
+    if (!isNonEmptyString(s.url))
+        return false;
+    if (typeof s.kind !== 'string' || !MEDIA_UPLOAD_KINDS.has(s.kind))
+        return false;
+    if (typeof s.mimeType !== 'string')
+        return false;
+    if (!isFiniteNumber(s.sizeBytes) || !Number.isInteger(s.sizeBytes) || s.sizeBytes < 0)
+        return false;
+    if (s.kind === 'audio') {
+        if (s.width !== undefined || s.height !== undefined)
+            return false;
+    }
+    else if (!isPositiveInteger(s.width) || !isPositiveInteger(s.height)) {
+        return false;
+    }
+    if (s.durationMs !== undefined && (!isFiniteNumber(s.durationMs) || s.durationMs < 0))
+        return false;
+    return true;
+}
+/**
+ * Reply to `OPEN_MEDIA_UPLOAD`: `{ requestId, selected }`, `{ requestId, error }`
+ * or a bare `{ requestId }` (dismissed / declined).
+ *
+ * `error` must be a string when present, and a reply carrying one is accepted
+ * without looking further: `useMediaUpload` throws on a PRESENT `error` before
+ * it reads `selected`. 🔴 Accepting it is load-bearing: dropping
+ * `{ requestId, error }` would leave the hook waiting out its whole
+ * human-interaction timeout on a refusal the host already sent.
+ */
+export function isValidMediaUploadResult(p) {
+    if (!isObject(p))
+        return false;
+    if (!isWireRequestIdShape(p.requestId))
+        return false;
+    if (p.error !== undefined && typeof p.error !== 'string')
+        return false;
+    if (p.error !== undefined)
+        return true; // hook throws before reading `selected`
+    if (p.selected !== undefined && !isValidMediaUploadInfo(p.selected))
+        return false;
+    return true;
+}
 /**
  * Reply to `SET_USER_CHECKPOINT`. `ok` is required on the success path; the
  * hook throws on `!ok || error !== undefined` — presence, not truthiness, so an
@@ -2167,6 +2336,10 @@ export function payloadValidatorFor(type) {
             return isValidImagesResult;
         case 'COLLECTION_FOLLOW_RESULT':
             return isValidCollectionFollowResult;
+        case 'ENTITY_REACTION_RESULT':
+            return isValidEntityReactionResult;
+        case 'ENTITY_REACTIONS_RESULT':
+            return isValidEntityReactionsResult;
         // 🔴 PRESENCE of this entry IS compiler-enforced (the `never` bind in
         // `default:`); WHICH validator it names is not. This reply settles a PUBLIC
         // POST, so the identity is pinned by test as well — see the mapping pin in
@@ -2223,6 +2396,8 @@ export function payloadValidatorFor(type) {
             return isValidResourcePickerResult;
         case 'IMAGE_PICKER_RESULT':
             return isValidImagePickerResult;
+        case 'MEDIA_UPLOAD_RESULT':
+            return isValidMediaUploadResult;
         case 'USER_CHECKPOINT_SET':
             return isValidUserCheckpointSetResult;
         case 'SUSPEND':

package/dist/version.generated.d.ts

@@ -1,3 +1,3 @@
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export declare const VERSION = "0.74.1";
+export declare const VERSION = "0.76.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -1,4 +1,4 @@
 /* AUTOGENERATED from package.json by scripts/gen-version.mjs. DO NOT EDIT. */
 /** This package's version, reported to the host as `sdkVersion` in `BLOCK_READY`. */
-export const VERSION = "0.74.1";
+export const VERSION = "0.76.0";
 //# sourceMappingURL=version.generated.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civitai/blocks-react",
-  "version": "0.74.1",
+  "version": "0.76.0",
   "description": "React hooks and iframe transport for Civitai Apps. Pairs with @civitai/app-sdk/blocks.",
   "license": "MIT",
   "type": "module",
@@ -37,7 +37,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@civitai/components": "^0.12.0",
+    "@civitai/components": "^0.13.0",
     "@civitai/theme": "^0.5.2"
   },
   "comment-peerDependencies": "This floor is DERIVED, not chosen — the lowest published app-sdk that exports every symbol this package imports. Do not edit it without reading ./PEER_FLOOR.md (in-repo, unpublished) and tests/guards/blocks-react-peer-floor.test.mjs.",
@@ -58,7 +58,7 @@
     "typescript": "^5.9.2",
     "vite": "^8.0.14",
     "vitest": "^4.1.11",
-    "@civitai/app-sdk": "^0.71.0"
+    "@civitai/app-sdk": "^0.75.0"
   },
   "publishConfig": {
     "access": "public"